2DkcTXceO

S.E. Fienberg 147that have now been instantiated in three major US statistical agencies andare part of the training of survey statisticians. Census Bureau surveys andcensus forms are now regularly developed using cognitive principles. Today,few students or practitioners understand the methodological roots of this enterprise.Tanur and I also linked these ideas to our ongoing work on combiningexperiments and surveys (Fienberg and Tanur, 1989).13.6 Privacy and confidentialityImentionedthatthePresident’sCommissionexploredthetopicofprivacyand confidentiality in depth in its report. But I failed to tell you that most ofthe discussion was about legal and other protections for statistical databases.Indeed, as I participated in discussions of large government surveys throughoutthe 1970s and 1980s, the topic was always present but rarely in the formthat you and I would recognize as statistical. That began to change in themid-1980s with the work of my then colleagues George Duncan and DianeLambert (1986, 1989) interpreting several rules for the protection of confidentialityin government practice using the formalism of statistical decisiontheory.IwasfinallydrawnintotheareawhenIwasaskedtoreviewthestatisticsliterature on the topic for a conference in Dublin in 1992; see Fienberg (1994).IdiscoveredwhatIliketorefertoasastatisticalgold-minewhoseveinsIhavebeen working for the past 21 years. There has been a major change since thePresident’s Commission report, linked to changes in the world of computingand the growth of the World Wide Web. This has produced new demandsfor access to statistical data, and new dangers of inappropriate record linkageand statistical disclosures. These are not simply national American issues, butrather they are international ones, and they have stimulated exciting technicalstatistical research.The Committee on National Statistics has been actively engaged in thistopic with multiple panels and workshops on different aspects of privacy andconfidentiality, and there is now substantial technical statistical literature onthe topic, and even a new online Journal of Privacy and Confidentiality; seehttp://repository.cmu.edu/jpc/.How does this work link to other topics discussed here? Well, much of myresearch has dealt with the protection of information in large sparse contingencytables, and it will not surprise you to learn that it ties to theory onlog-linear models. In fact, there are also deep links to the algebraic geometryliterature and the geometry of 2 × 2 contingency tables, one of those problemsFred Mosteller introduced me to in 1966. See Dobra et al. (2009) for somedetails.